diff --git a/config/config.hcl b/config/config.hcl index ef787cb..cb6193f 100644 --- a/config/config.hcl +++ b/config/config.hcl @@ -260,15 +260,11 @@ locals { netbox_secret_backend_role = { for file_path, content in local.all_configs : trimsuffix(replace(file_path, "netbox_secret_backend_role/", ""), ".yaml") => merge(content, { - name = trimsuffix(basename(file_path), ".yaml") - backend = dirname(replace(file_path, "netbox_secret_backend_role/", "")) + name = trimsuffix(basename(file_path), ".yaml") + netbox_username = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "netbox_secret_backend_role/", "")) }) if startswith(file_path, "netbox_secret_backend_role/") } - netbox_user = { - for file_path, content in local.all_configs : - trimsuffix(basename(file_path), ".yaml") => content - if startswith(file_path, "netbox_user/") - } } } diff --git a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml index 06074a5..ac390ac 100644 --- a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml +++ b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml @@ -1,10 +1,25 @@ -# Role minting ephemeral NetBox tokens for the terraform-infra CI runner. -# terraform-infra manages NetBox IPAM/devices, so tokens carry write access -# (write_enabled true). Very short TTLs because a token is minted per plan/apply -# and revoked when the run's lease ends. Reading netbox/creds/terraform-infra -# mints a lease-bound token deleted from NetBox on revoke/expiry. +# Single declarative source for the terraform-infra NetBox service identity. The +# filename stem is the engine role name AND the NetBox username (1:1); config.hcl +# derives both from it, so neither is repeated below. Creating this file creates +# the user: the netbox_user_management module synthesizes the NetBox user + object +# permissions from the permissions block, and the engine role mints ephemeral +# tokens for that same user. write_enabled true because terraform-infra manages +# NetBox IPAM/DCIM; very short TTLs because a token is minted per plan/apply and +# revoked when the run's lease ends. --- -netbox_username: terraform-infra write_enabled: true ttl: 120 # 2m max_ttl: 300 # 5m +permissions: + - object_types: + - ipam.prefix + - ipam.ipaddress + - ipam.iprange + - dcim.device + - dcim.interface + - dcim.macaddress + actions: + - view + - add + - change + - delete diff --git a/config/netbox_user/terraform-infra.yaml b/config/netbox_user/terraform-infra.yaml deleted file mode 100644 index 4661870..0000000 --- a/config/netbox_user/terraform-infra.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Declarative NetBox service identity for the terraform-infra CI runner. The -# filename stem is the NetBox username and matches the netbox engine role name -# 1:1 (netbox/roles/terraform-infra mints tokens for this user). Ben seeds only -# the engine admin token; this user and its permissions are created from here, -# never by hand. Write access covers the IPAM/DCIM objects terraform-infra -# manages (prefixes, ip-addresses, ip-ranges, devices, interfaces, mac -# addresses, plus the supporting role/tag/type objects it also touches). ---- -backend: netbox -active: true -staff: false -permissions: - - name: terraform-infra - description: terraform-infra IPAM/DCIM write access (tokens minted by Vault) - object_types: - - ipam.prefix - - ipam.ipaddress - - ipam.iprange - - ipam.role - - dcim.device - - dcim.interface - - dcim.macaddress - - dcim.manufacturer - - dcim.devicetype - - dcim.devicerole - - extras.tag - actions: - - view - - add - - change - - delete diff --git a/environments/au/syd1/terragrunt.hcl b/environments/au/syd1/terragrunt.hcl index 0e2a05b..44b3338 100644 --- a/environments/au/syd1/terragrunt.hcl +++ b/environments/au/syd1/terragrunt.hcl @@ -89,7 +89,6 @@ inputs = { netbox_secret_backend = local.config.netbox_secret_backend netbox_secret_backend_role = local.config.netbox_secret_backend_role - netbox_user = local.config.netbox_user # Pass policy maps to vault_cluster module policy_auth_map = local.policies.policy_auth_map diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf index 4953d39..bfd7e0d 100644 --- a/modules/vault_cluster/main.tf +++ b/modules/vault_cluster/main.tf @@ -477,13 +477,15 @@ module "netbox_secret_backend" { # Declaratively manage the NetBox service users + object permissions the engine # roles mint tokens for, using the seeded admin token (mirrors consul_acl_management). +# Consumes the SAME role config as netbox_secret_backend_role: one file per identity, +# filename-derived username, inline permissions. module "netbox_user_management" { source = "./modules/netbox_user_management" country = var.country region = var.region netbox_backends = var.netbox_secret_backend - netbox_users = var.netbox_user + netbox_roles = var.netbox_secret_backend_role netbox_backend_aliases = var.netbox_backend_aliases } diff --git a/modules/vault_cluster/modules/netbox_user_management/main.tf b/modules/vault_cluster/modules/netbox_user_management/main.tf index 7142d2f..a5692d0 100644 --- a/modules/vault_cluster/modules/netbox_user_management/main.tf +++ b/modules/vault_cluster/modules/netbox_user_management/main.tf @@ -24,19 +24,20 @@ provider "netbox" { # NetBox users authenticate only via Vault-minted API tokens, never the web UI, # so give each a random unknown password (required by the API) that no one holds. resource "random_password" "user" { - for_each = var.netbox_users + for_each = var.netbox_roles length = 32 special = true } -# Declarative NetBox service users, one per engine role (username == role name). +# Declarative NetBox service users, one per engine role. The role's filename- +# derived name is the username, so the engine role and its user match 1:1. resource "netbox_user" "users" { - for_each = var.netbox_users + for_each = var.netbox_roles provider = netbox.by_backend[each.value.backend] - username = each.key + username = each.value.name password = random_password.user[each.key].result active = each.value.active staff = each.value.staff @@ -44,14 +45,16 @@ resource "netbox_user" "users" { } locals { - # Flatten users x permissions into one map keyed by ":". + # Flatten roles x permissions into one map keyed by ":". A + # permission's name defaults to the role name (the username) so a single- + # permission identity repeats nothing already encoded by the filename. netbox_permissions = merge([ - for username, user in var.netbox_users : { - for perm in user.permissions : - "${username}:${perm.name}" => { - backend = user.backend - user = username - name = perm.name + for role_key, role in var.netbox_roles : { + for idx, perm in role.permissions : + "${role_key}:${idx}" => { + backend = role.backend + user = role_key + name = coalesce(perm.name, length(role.permissions) == 1 ? role.name : "${role.name}-${idx}") object_types = perm.object_types actions = perm.actions constraints = perm.constraints diff --git a/modules/vault_cluster/modules/netbox_user_management/variables.tf b/modules/vault_cluster/modules/netbox_user_management/variables.tf index ecd8e5c..051907c 100644 --- a/modules/vault_cluster/modules/netbox_user_management/variables.tf +++ b/modules/vault_cluster/modules/netbox_user_management/variables.tf @@ -6,15 +6,16 @@ variable "netbox_backends" { })) } -variable "netbox_users" { - description = "Map of NetBox service users to create declaratively, keyed by username (1:1 with the engine role name)" +variable "netbox_roles" { + description = "Map of netbox engine roles (the netbox_secret_backend_role config). Each role's filename-derived name is the NetBox username to create, and its permissions block is the user's object-permission set. Keyed by the role's config path." type = map(object({ + name = string backend = string active = optional(bool, true) staff = optional(bool, false) email = optional(string) permissions = optional(list(object({ - name = string + name = optional(string) object_types = list(string) actions = optional(list(string), ["view", "add", "change", "delete"]) constraints = optional(string) diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf index 3d89fa6..be7b04d 100644 --- a/modules/vault_cluster/variables.tf +++ b/modules/vault_cluster/variables.tf @@ -431,7 +431,7 @@ variable "netbox_secret_backend" { } variable "netbox_secret_backend_role" { - description = "Map of netbox token-minting roles to create" + description = "Map of netbox engine roles; each role's filename-derived name is both the engine role and the NetBox username it mints tokens for, and its permissions block is the user's object-permission set" type = map(object({ name = string backend = string @@ -441,19 +441,11 @@ variable "netbox_secret_backend_role" { description = optional(string) ttl = optional(number) max_ttl = optional(number) - })) - default = {} -} - -variable "netbox_user" { - description = "Map of NetBox service users to create declaratively (keyed by username; 1:1 with the engine role name)" - type = map(object({ - backend = string - active = optional(bool, true) - staff = optional(bool, false) - email = optional(string) + active = optional(bool, true) + staff = optional(bool, false) + email = optional(string) permissions = optional(list(object({ - name = string + name = optional(string) object_types = list(string) actions = optional(list(string), ["view", "add", "change", "delete"]) constraints = optional(string)